Give it tools without giving it the keys to everything

This is where a chatbot becomes an assistant

Tools let the model request information or actions. They are also the biggest security boundary in the project.

# Do not do this.
os.system(llm_response)

Use an allowlist

TOOLS = {
    "system_info": system_info,
    "list_files": list_files,
    "read_text_file": read_text_file,
}

def run_tool(name, arguments):
    if name not in TOOLS:
        raise ValueError("Tool is not allowed")
    validated = validate_arguments(name, arguments)
    return TOOLS[name](**validated)

Start with read-only tools

• system_info()
• get_disk_space()
• list_files(path) inside one approved workspace
• read_text_file(path) with size limits
• search_notes(query)

Then add actions with confirmation

When you eventually add write, move, delete, process-control, email, or network actions, put a confirmation step between the model request and execution.

Assistant wants to delete:
C:\AI-Workspace\old-build.zip

Allow this action? [y/N]

Use a tool execution pipeline

Model requests tool
        │
        ▼
Is tool allowlisted?
        │
        ▼
Validate argument types + ranges + paths
        │
        ▼
Need confirmation? ── yes ──► ask user
        │
        ▼
Execute with least privilege
        │
        ▼
Record actual result
        │
        ▼
Return result to model

Recommended guardrails

• Restrict file tools to one configured workspace.
• Canonicalize paths and reject traversal outside that root.
• Limit file sizes and result lengths.
• Do not run the assistant as administrator/root.
• Require confirmation for destructive or external side effects.
• Keep an audit log of requested tool, validated arguments, outcome, and time.
• Keep network tools separate from the offline core and label when they are enabled.